HPE Fabric Composer EUVD-2026-116275

The attacker needs network access to the command-line interface of HPE Networking Fabric Composer and knowledge of the hardcoded credentials embedded in that CLI; per the description no special configuration or enabled feature is required, so default deployments are affected. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no legitimate authentication, no user interaction, and low complexity. The practical limiting factor is network reachability of the management/CLI interface - appliances whose management plane is isolated or firewalled from untrusted networks substantially reduce exposure - and exploitation becomes trivial once the static credentials are published or reverse-engineered.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a remotely reachable flaw with no required privileges and no user interaction, and the description confirms the mechanism: hardcoded credentials in the command-line interface that grant administrative, elevated access. Because PR:N is set, this is treated as unauthenticated per the vector. The vuln.today decision label is act_now, which reinforces urgency. However, the signal set is partial: no EPSS exploitation-probability score, no CISA KEV entry, and no POC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no quantified likelihood of mass exploitation. The risk is driven by the trivially weaponizable nature of static backdoor-style credentials (once the credentials are known, exploitation is deterministic) rather than by observed in-the-wild activity. In short: severity and triggerability are high and the act_now label is justified, but active exploitation is not confirmed by the available data - treat as high-priority remediation, not as a confirmed active-exploitation emergency.

An attacker with network reachability to the HPE Networking Fabric Composer CLI (for example, its SSH/management interface) connects and logs in using the hardcoded credentials, obtaining administrative access with elevated privileges without needing any legitimate account. No public exploit is identified at time of analysis, but exploitation requires no special skill once the static credentials are known, and the low attack complexity (AC:L) with no user interaction (UI:N) makes it straightforward against a reachable instance.